Just go to "Settings" - "Licensing" - there's all you need. ... View more

Glad you have a solution. Some points to consider: you really should think about using the default ports, especially don't use 9997 - which is normally used for ingesting data - as the web gui port (which normally is 8000) - it makes things unnecessary confusing while reading docs or ask questions e.g. at answers.splunk.com 😉 as v8.0.1 is out all versions 6.x are at the end of life; so it seems to be the right time to upgrade your installation to something more current, e.g. 7.3.3; have a look here for details ... View more

9997 - in a default installation - is the port you use for incoming data, e.g. from your Universal Forwarders. The management port - in a default installation - which you use to access the REST API using your browser is 8089. Using that no "en-US" will be added to your URL. ... View more

Just to cut this out: which port are you using as management port? ... View more

That's bad. ... View more

This is old - but: do you still think that the shown outputs.conf on th HFW is cloning events? If so, why? To my knowledge a [tcpout-server:<ipaddr>] stanza could be used for server specific configuration. But that's only in addition to the settings done in a server group, i.e. something like [tcpout:my-1st-indexer-group] . ... View more

You have to put single quotes around the key - and in one attempt I had to remove the trailing equal-signs. BTW - there's also a splunk show-encrypted --value 'topsecret' - which creates strings starting with "$7$" - but I have no idea how/where to use it. ... View more

Some older question but the "which type counts what" topic is still current. Try the following two commands as examples: type=Usage - data from the day before yesterday index=_internal source=/opt/splunk/var/log/splunk/license_usage.log type=Usage earliest=-2d@d latest=-1d@d | stats sum(b) type=RolloverSummary - data from yesterday, which is the aggregated data of the day before yesterday index=_internal source=/opt/splunk/var/log/splunk/license_usage.log type=RolloverSummary earliest=-1d@d latest=@d | stats sum(b) The result is exactly the same - at least on my testsystem. The license usage of one day is aggregated at midnight and added to the _internal index. Unfortunately I don't know the technical details and I have no documentation link. You can match the data of both types like the following: type=Usage type=RolloverSummary =================================== pool pool (the license pool) i slave (the GUID of the indexer as defined in $SPLUNK_HOME/etc/instance.cfg) b b (the byte count - summed up for the previous day the RolloverSummary-type) Addionally type=Usage has some more columns to investigate or differentiate: h the host sending the data (e.g. a UF) s the source of the data (e.g. /var/log/messages or XmlWinEventLog:Application) st the sourcetype of the data (e.g. syslog or XmlWinEventLog) idx the index where the data is ingested ... View more

The Splunk App for Windows Infrastructure comes with a predefined role winfra-admin . The sole purpose of this role is to set the indexes msad , perfmon , windows and wineventlog as "Indexes searched by default. So the user who works with the Windows-App has permission to see all the events in these indexes. If you do not have or use Splunk App for Windows Infrastructure , just create some simliar role and assign this to your user - then you should be fine without changing any of the out-the-box-reports, -macros and dashboards for the MS Windows AD Objects -App. Here is the content of the default authorize.conf : [role_winfra-admin] srchIndexesDefault = msad;winevents;windows;wineventlog;perfmon ... View more

Are you on a Windows system or Linux? transforms.conf in v1.3.4 has Windows-style line separation (i.e. CR-LF). Maybe that leads to some trouble - of course, if at all, then on Linux. ... View more

It's the same with 7.2.7. Actually I found three files for every name out of dashboards.xml, alerts.xml and reports.xml 192d5302d90ac263139a379f11fa0236b167f3b1198590d383324ee683cc035a etc/apps/search/default/data/ui/manager/dashboards.xml 76af1d8adf98be3448cc1643208d62adf6c41ad6d6385aab946e19a926409020 etc/apps/search/default/data/ui/views/dashboards.xml 76af1d8adf98be3448cc1643208d62adf6c41ad6d6385aab946e19a926409020 etc/apps/splunk_monitoring_console/default/data/ui/views/dashboards.xml These files, paths and sums are the same in 7.1.1, 7.2.7 and 7.3.0 (and presumably at least all the versions in between). The sha256-sums are the same as contained in the manifest file in /opt/splunk so everything seems ok. Still some official statement or opinion would be great. Also I found some reference to the same "errors" in a 2016-posting regarding v6.4.0. In v6.2.0 when the DMC was introduced, there are only the two files inside the search app but already with the same sha256sum. The only reference to the dashboards.xml file is in default/data/ui/nav/default.prod_lite.xml which maybe belongs to an installation of Splunk Light(?). I did a second run of the migration check after renaming dashboards.xml to my_dashboards.xml and it disappeared from the list of "UI view conflicts". ... View more

just added the missing link... ... View more

You may have a look at this slide deck, especially slide 27. It's a pure streaming command search using some field extraction. That kind of search is done on the indexer and it depends on uncompressing all the packed raw data files, which - as we now know - are all on one disk => slow Of course, displaying the events will take some small amount of memory, but really, that won't be the bottleneck in this scenario. ... View more

For the Linux machine you could use cat /proc/cpuinfo for getting processor information. The interesting figures are "number of cores" and "cpu speed". Regarding the one SSD: Splunk recommends 800IOPS, which one SSD probably isn't able to deliver. So this may be your bottleneck. In your first post you wrote "hundreds of millions of data from billions of data" - what is this in GB? What is this as event count? Still there's not sure, what you want to achieve with your query. As @martin_mueller pointed out - there's not much sense in just displaying "hundreds of millions of data". So you probably want to do something else with your data. Would be very helpful - if not essential - to get an idea of what you're planning to do? ... View more

Ok, this way we could get further. Should have asked earlier, but: are you using virtual machines? What are the characteristics of your servers/VMs regarding CPU, RAM. I assume you have one (i.e. "1") SSD in your environment? ... View more

My first question was: what is your environment? Do you run Splunk in a standalone installation? What kind of storage do you have attached? ... View more

So what's your environment (regarding Indexer(s) and searchhead(s), storage)? And where are you examining the resource consumption? ... View more

I downvoted this post because that's just wrong. although this message reads as there's no doubt about its truth. Have a look at https://docs.splunk.com/documentation/forwarder/7.3.0/forwarder/compatibilitybetweenforwardersandindexers - there's no such constraint as you write. And it's clearly stated in the message that this message do belong to ssl. ... View more

If you just name your script custom_script.sh - using exactly the phrase from the corresponding alerts_action.conf stanza, the bash.path file and the alert.execute.* entries in alert_actions.conf are not necessary. ... View more

Using just the App-name does not work. You have to use the archive name - otherwise splunk install app ... has no idea what to install. ... View more

Some time ago - but anyway: It seems you are using system (i.e. Linux or similar) credentials to login to Splunk. That won't work. You have to use your Splunk-(Web)-credentials to connect to Splunk. Also you have to make sure that you have the permission to install an app (also inside of Splunk). And last - "Splunk_DA-ESS_PCICompliance" is the name of the installed app. On the commandline you have to use the name of the tar archive, e.g. splunk install app splunk-app-for-pci-compliance-splunk-enterprise_370.spl ... View more

These lists are lookup tables. You could update them just like any other lookup table - but, somehow you have to get the data. LDAP is one option for identities, CMDB is one option for assets. ... View more

AFAIK, these dashboards are filled solely with data from "notable events". To create these events you have to enable the corresponding correlation searches in the App's configuration. ... View more

"Free Splunk" is NOT the same as the "60-day-trial-Splunk Enterprise". The former allows you to use Splunk in your environment, ingesting 500MB/day but leaving out many (if not all) of the features you for sure want in an enterprise environment, e.g. authentication or clustering. But still you have the main professional functionality like indexing, searching, reports, dashboards etc. with all their benefits. The latter is the complete Splunk Enterprise solution with no reduction in functionality - but for a 60-day-trial period. In my opinion it would be unreasonable from a Splunk Inc.'s perspective to "give it away for free" 😉 Have a look to see the differences between the Splunk versions. You can still change your trial-installation to the free version: Just go to "Settings - LIcensing - Change License Group" and select "Free Splunk". But be aware that there's no authentication any longer. So if your Splunk installation is directly connected to the internet, everyone could analyse your data... ... View more